build: enable missing OpenSSF-recommended warnings, with fixes#12489
Closed
vszakats wants to merge 34 commits intocurl:masterfrom
Closed
build: enable missing OpenSSF-recommended warnings, with fixes#12489vszakats wants to merge 34 commits intocurl:masterfrom
vszakats wants to merge 34 commits intocurl:masterfrom
Conversation
vszakats
commented
Dec 8, 2023
bagder
reviewed
Dec 8, 2023
8467031 to
722d4c8
Compare
Member
Author
|
This is ready now. |
bagder
reviewed
Dec 11, 2023
vszakats
commented
Dec 11, 2023
Member
Author
|
Renamed to use Is there something else to address? |
also add `-Wsign-conversion` commented, with FIXME
This was referenced Apr 29, 2024
vszakats
added a commit
that referenced
this pull request
May 11, 2024
- extend `FD_SET()` hack to all platforms (was only Cygwin). Warnings may also happen in other envs, e.g. OmniOS. Ref: https://github.com/libssh2/libssh2/actions/runs/8854199687/job/24316762831#step:3:2021 - tidy-up `CURLcode` vs `int` use. - cast an unsigned to `long` before passing to `curl_easy_setopt()`. Cherry-picked from #13489 Follow-up to 3829759 #12489 Closes #13501
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jun 5, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jun 5, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
1 task
vszakats
added a commit
that referenced
this pull request
Sep 2, 2024
Change mingw-w64 printf format checks in public curl headers to use `__MINGW_PRINTF_FORMAT` instead of `gnu_printf`. This syncs the format checker with format string macros published via `curl/system.h`. (Also disable format checks for mingw-w64 older than 3.0.0 (2013-09-20) and classic-mingw, which do not support this macro.) This fixes bogus format checker `-Wformat` warnings in 3rd party code using curl format strings with the curl printf functions, when using mingw-w64 7.0.0 (2019-11-10) and older (with GCC, MSVCRT). It also allows to delete two workaounds for this within curl itself: - setting `-D__USE_MINGW_ANSI_STDIO=1` for mingw-w64 via cmake and configure for `docs/examples` and `tests/http/clients`. Ref: c730c85 #14640 The format check macro is incompatible (depending on mingw-w64 version and configuration) with the C99 `%z` (`size_t`) format string used internally by curl. To work around this problem, override the format check style in curl public headers to use `gnu_printf`. This is compatible with `%z` in all mingw-w64 versions and allows keeping the C99 format strings internally. Also: - lib/ws.c: add missing space to an error message. - docs/examples/ftpgetinfo.c: fix to use standard printf. Ref: #14643 (take 1) Follow-up to 3829759 #12489 Closes #14703
vszakats
added a commit
that referenced
this pull request
Jan 9, 2025
We decided last year not to pursue avoiding this warning, because it adds noise and friction, while in most cases not revealing actual code issues. We fixed the interesting portion of them throughout mid-2024. Conclude this effort by deleting related FIXMEs and temporary comments. Follow-up to 3829759 #12489 Closes #15939
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
[as of 2023-11-29]
Enable new recommended warnings (except
-Wsign-conversion):-Wformat=2for clang (in both cmake and autotools).CURL_PRINTF()internal attribute and mark functions acceptingprintf arguments with it. This is a copy of existing
CURL_TEMP_PRINTF()but using__printf__to make it compatiblewith redefinting the
printfsymbol:https://gcc.gnu.org/onlinedocs/gcc-3.0.4/gcc_5.html#SEC94
CURL_PRINTF()and existingCURL_TEMP_PRINTF()formingw-w64 and enable it on this platform.
-Wimplicit-fallthrough.-Wtrampolines.-Wsign-conversioncommented with a FIXME.-pedantic-errorsthe way we do it with autotools.Follow-up to d5c0351 Enable and fix more GCC warnings #2747
CURL_FORMAT(), this also fixes it to enable formatchecks. Previously it was always disabled due to the internal
printfmacro.
Fix them:
set_ipv6_v6only()call was missed in builds with--disable-verbose/CURL_DISABLE_VERBOSE_STRINGS=ON.FALLTHROUGH()macro.FALLTHROUGH().warnings in most cases). Add missing ones. Fix indentation.
-Wformat-nonliteralwarnings with llvm/clang.-Wformat-nonliteralwarning.-Wformatand-Wformat-securitywarnings.CURL_FORMAT_SOCKET_Tvalue for mingw-w64. Also move itsdefinition to
lib/curl_setup.hallowing use intests/server.Co-authored-by: Jay Satiro
-Wformatwarnings on mingw-w64.Closes #12489
TODO:
-Warith-conversionwarnings. [other PR]-Wsign-conversionwarnings. [other PR]